home

psexec.exe

Sysinternals PsExec

Microsoft Corporation

This is a setup program which is used to install the application. The file has been seen being downloaded from live.sysinternals.com and multiple other hosts.
Publisher:
Sysinternals - www.sysinternals.com  (signed by Microsoft Corporation)

Product:
Sysinternals PsExec

Description:
Execute processes remotely

Version:
2.11

MD5:
a7f7a0f74c8b48f1699858b3b6c11eda

SHA-1:
b5c62d79eda4f7e4b60a9caa5736a3fdc2f1b27e

SHA-256:
3b08535b4add194f5661e1131c8e81af373ca322cf669674cf1272095e5cab95

Scanner detections:
0 / 68

Status:
Clean (as of last analysis)
Whitelisted  (by digital signature)

Analysis date:
11/5/2024 8:27:22 PM UTC  (today)

File size:
387.2 KB (396,480 bytes)

Product version:
2.11

Copyright:
Copyright (C) 2001-2014 Mark Russinovich

Original file name:
psexec.c

File type:
Executable application (Win32 EXE)

Language:
English (United States)

Digital Signature
Signed by:
Microsoft Corporation

Authority:
Microsoft Corporation

Valid from:
4/22/2014 7:39:00 PM

Valid to:
7/22/2015 7:39:00 PM

Subject:
CN=Microsoft Corporation, OU=MOPR, O=Microsoft Corporation, L=Redmond, S=Washington, C=US

Issuer:
CN=Microsoft Code Signing PCA, O=Microsoft Corporation, L=Redmond, S=Washington, C=US

Serial number:
33000000CA6CD5321235C4E1550001000000CA

File PE Metadata
Compilation timestamp:
3/30/2014 10:50:45 PM

OS version:
5.0

OS bitness:
Win32

Subsystem:
Windows Console

Linker version:
9.0

CTPH (ssdeep):
6144:/FTsPtVBzQJLe1wm5wxszGaMtqGWU5RXMpS8fhkWLTFYoBQJl3u+sJ:9wPtV9a0wm5wxs6aMt3Qdfhkk/6K+2

Entry address:
0x9645

Entry point:
E8, D8, BB, 00, 00, E9, A5, FE, FF, FF, 8B, FF, 56, 57, 33, F6, BF, B8, 75, 43, 00, 83, 3C, F5, BC, 13, 43, 00, 01, 75, 1E, 8D, 04, F5, B8, 13, 43, 00, 89, 38, 68, A0, 0F, 00, 00, FF, 30, 83, C7, 18, E8, AF, 86, 00, 00, 59, 59, 85, C0, 74, 0C, 46, 83, FE, 24, 7C, D2, 33, C0, 40, 5F, 5E, C3, 83, 24, F5, B8, 13, 43, 00, 00, 33, C0, EB, F1, 8B, FF, 53, 8B, 1D, 5C, 72, 42, 00, 56, BE, B8, 13, 43, 00, 57, 8B, 3E, 85, FF, 74, 13, 83, 7E, 04, 01, 74, 0D, 57, FF, D3, 57, E8, 4E, D5, FF, FF, 83, 26, 00, 59, 83, C6...
 
[+]

Code size:
149 KB (152,576 bytes)

The file psexec.exe has been discovered within the following programs.

Friendly Pinger  by A.Kilievich & Co.
Publisher's description - “Friendly Pinger is a freeware application for network administration, monitoring and inventory. Visualization of your computer network as a beautiful animated screen. Audit software and hardware components installed on the computers over the network.”
www.kilievich.com/fpinger
About 1% of users remove it
PC Matic Agent  by PC Pitstop LLC
About 1% of users remove it
PDQ Deploy  by Admin Arsenal
About 4% of users remove it
Run Remote  by FORUM Information Systems
About 8% of users remove it
ZD Soft Screen Monitor  by ZD Soft
www.zdsoft.com/screen-monitor
About 8% of users remove it
 
Powered by Should I Remove It?

The file psexec.exe has been seen being distributed by the following 4 URLs.

https://live.sysinternals.com/psexec.exe

https://fs09n5.sendspace.com/dl/e45e7e6f68f4103a36bcde0e84bc642c/56f385bb2de40752/.../PsExec.exe

http://download.softpedia.com/dl/0dabcaf7fd38d3ae093bcb63c67e7a07/545fab86/100035253/software/.../PsExec.exe

http://live.sysinternals.com/psexec.exe

herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.